VulnerabilityModified
CVE-2007-3737
Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document."
HIGH 9.3EPSS 4.62%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 4.62% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox
- Source
- secalert@redhat.com
References
- ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt
- ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742
- http://secunia.com/advisories/25589
- http://secunia.com/advisories/26072
- http://secunia.com/advisories/26095Patch, Vendor Advisory
- http://secunia.com/advisories/26103
- http://secunia.com/advisories/26106
- http://secunia.com/advisories/26107
- http://secunia.com/advisories/26149
- http://secunia.com/advisories/26151
- http://secunia.com/advisories/26159
- http://secunia.com/advisories/26179
- http://secunia.com/advisories/26204
- http://secunia.com/advisories/26205
- http://secunia.com/advisories/26211
- http://secunia.com/advisories/26216
- http://secunia.com/advisories/26258
- http://secunia.com/advisories/26271
- http://secunia.com/advisories/26460
- http://secunia.com/advisories/28135
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1
- http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html
- http://www.debian.org/security/2007/dsa-1337
- http://www.debian.org/security/2007/dsa-1338
- http://www.debian.org/security/2007/dsa-1339
- http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:152
- http://www.mozilla.org/security/announce/2007/mfsa2007-21.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.